fix(mcp,platform-objects): SSO provider, OAuth application and Connect-an-Agent copy says "this system" (cloud#3002 ruling A) (#24432)

Fixes #24405

Clause-②: no (copy only: no accept set or public surface moves; owes the
seat's review of record at `TIER_DEFAULT` before the queue)

## What changed

objectstack-ai/cloud#3002 ruling A, as triage applied it (`6250167038`
on #24327, `6252585695` on #24368): "made here, not from a package"
reads "authored in this system"; the system the caller is in drops the
noun or says "this system"; a string that means a deployment or
configuration scope keeps its word. Every string the card lists was read
and is either changed or left with its reason below.

| site (by symbol) | before | after | reading |
|:--|:--|:--|:--|
| `sys_oauth_application` grid `all_apps`, `emptyState.message`
(`sys-oauth-application.object.ts`) | ... sign users in with this
environment. | ... sign users in with this system. | the system the user
is in: "this system" |
| `sys_sso_provider` object `description` (`sys-sso-provider.object.ts`)
| External SSO identity providers (OIDC / SAML) this environment
federates login to | ... this system federates login to | same |
| `sys_sso_provider` action `register_sso_provider`, param `clientId`
help text | OAuth client ID issued by the IdP for this environment. |
... for this system. | same: the relying party the IdP registered is the
running system; no environment is contrasted with another |
| Connect-an-Agent `page:header` subtitle
(`packages/mcp/src/connect-ui.ts`, `CONNECT_AGENT_PAGE`) and its `en`
copy (`platform-objects` `en.ts`, `pages.connect_agent.subtitle`) | Give
any MCP-capable AI client governed access to this environment — ... |
Give any MCP-capable AI client governed access to this system — every
call runs under the caller's own permissions and row-level security. |
the sentence #24404 chose; both literals in ONE commit (317fadc) |
| `deletePackage`'s retired-key refusal
(`packages/metadata-protocol/src/protocol.ts`) | An uninstall is
environment-wide — it removes every row bound to the package in this
environment — so no organization scope is stated or confirmed. |
**kept** | a deployment/configuration scope: "environment-wide" is
ADR-0131 D6's name for the row scope that is not an organization's
(`organizationId: null`), and the sentence exists to contrast that scope
with the organization scope the retired key used to pick. "in this
environment" restates the extent of that same scope; renaming it alone
would break the contrast the refusal is built on. The sibling remedy in
the same file ("the write then lands environment-wide, where every
organization reads it.") uses the same vocabulary and is not on this
card either. |
| `en.metadata-forms.generated.ts`, permission set `packageId` help text
("... created in this environment.") | — | **kept, not regenerated** |
it follows `packages/spec/src/security/permission.form.ts`, which is
#24406 (`domain:spec`, open). The spec source still says "created in
this environment" on `origin/main` `e22defb13`, so regenerating changes
nothing; it is never hand-edited. #24406 remains open for it. |
| `sys_metadata_activation` object description | — | untouched | already
"authored in this system" on `main` (PR #24401); verified, not touched |

**Translations.** The same phrase in the translated leaves is
re-translated by hand, as AGENTS.md allows for translated-locale values:

- Connect-an-Agent subtitle: zh-CN 此环境 → 本系统, ja-JP この環境 → このシステム, es-ES
este entorno → este sistema, in `zh-CN.ts`, `ja-JP.ts`, `es-ES.ts`. The
recorded source hash `pages.connect_agent.subtitle` in the three
`*.source-hashes.ts` files moves from `2d0f9a000824e78a` to
`b0d7c6d174511bcb`, computed with `hashSource` from `source-hash.ts`
(control: the same call on the old English text returns
`2d0f9a000824e78a`, the recorded value).
- The three object strings in `zh-CN` / `ja-JP` /
`es-ES.objects.generated.ts`, the same substitution. None of the three
leaves has an entry in any `*.source-hashes.generated.ts` (they are
legacy-trusted translator text), so no generated hash moves;
`check-i18n-bundles --write` kept all six hand values and rewrote only
the three `en` leaves.

No code, status, error code or envelope field changes. Nothing else in
`packages/mcp` moves.

## The fallback, measured

`packages/cli/test/platform-page-i18n-parity.test.ts`, through
`scripts/pm/os-verify-lock.sh`, after building the CLI closure:

- Both English literals and the three translations changed, hashes NOT
moved (WIP commit, since squashed): `Tests 1 failed | 26 passed (27)`;
the red test is "rewrites the page:header copy end-to-end for a
non-English locale" (the zh-CN subtitle fell back to English).
- Hashes moved: `Tests 27 passed (27)`.

So the hashes are load-bearing: without them every non-English locale
silently serves English.

## Pins

The parity test is the one consumer that parses this text (it holds the
`en` bundle byte-identical to the page literal), and it is green with
the new sentence on both sides. No other test, fixture, docs page, skill
or platform-checklist item quotes any of the changed strings (`git grep`
over the tree). `packages/rest/src/rest.test.ts` and
`packages/spec/src/system/i18n-resolver.test.ts` carry a zh-CN fixture
ending 受控访问此环境。 — it is each test's own inline translation fixture, not
read from this bundle, so it pins nothing here (and `packages/spec` is
outside this card).

## Verification (head d9ac891, after merging `origin/main`
`e22defb13`)

- Build: CLI closure (`--filter '@objectstack/cli^...'`) `VERDICT
command-exit 0`; the `check:i18n` prerequisite closure `61 successful,
61 total`; full `turbo run build --concurrency=2` `77 successful, 77
total`. After the last merge: `@objectstack/mcp` +
`@objectstack/platform-objects` rebuilt, exit 0.
- Typecheck (after the last merge): `@objectstack/mcp` exit 0,
`@objectstack/platform-objects` exit 0, `@objectstack/cli` (test-only
consumer) exit 0, each with `check:test-typecheck` green.
- Tests: `@objectstack/platform-objects` `Test Files 77 passed (77)`,
`Tests 1184 passed (1184)`; `@objectstack/mcp` `Test Files 40 passed
(40)`, `Tests 479 passed (479)`; `@objectstack/cli`
`test/platform-page-i18n-parity.test.ts` `Tests 27 passed (27)` (re-run
after the last merge: 27 passed).
- `pnpm check:i18n`: `OK (10 package(s) — all bundles in sync, no
undeclared authoring keys)`.
- Gates: `node scripts/pm/dispatch-gates.mjs --commands` (no paths) on
d9ac891 derived 59 commands; all 59 exit 0
(`check:dual-build-cjs-loads` first exited 3, PREREQUISITE NOT MET, on
the first run and exit 0 after the full build). `--ran`: `Run
reconciliation — 59 derived, 59 run, 0 NOT-MEASURED, 0 UNRUN`.
- `pnpm exec eslint --no-inline-config` over the 10 changed `.ts` source
files: exit 0.
- `test:repo` not run locally (CI `Test Core`).

## Acceptance notes

- `en.objects.generated.ts`'s `sys_metadata_history` description "...
(environment-wide, append-only)" is the same ADR-0131 D6 scope word and
not on this card's list. Left.
- `packages/mcp/src/connect-ui.ts`'s bundle `description` (about `:84`)
already reads "... to this system." on `main` (PR #24413); not touched.
`mcp-server-runtime.ts`'s `:1448` text is a `logger.warn` line, and
`skill-md.ts`'s "ObjectStack environment" names a deployment addressed
from outside; both are #24404's readings and outside this card.
- `plugin-auth`'s `auth-schema-config.ts` comment "OIDC/SAML IdP this
environment federates login to" is a code comment and `domain:services`'
(#24368); not touched.
- #24406 is not addressed here; it remains open for the
`permission.form.ts` help text and its generated `en` leaf.

Durable attribution: os-dev run for #24405, cloud session
`session_01QBmxwa8mRD3b48FhBBieJ9`, dispatched by the `domain:engine`
seat 1 PM (`session_01JtSQQ3EWsbNPzyYMug1tXy`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---
_Generated by [Claude
Code](https://claude.ai/code/session_01QBmxwa8mRD3b48FhBBieJ9)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/24405-mcp-connect-agent-subtitle.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/mcp': patch
+---
+
+Clause-②: no (copy only: no accept set or public surface moves; owes the seat's review of record at `TIER_DEFAULT` before the queue)
+
+fix(mcp): the Connect-an-Agent page subtitle says "this system"
+
+- **What changed.** The Connect-an-Agent page header now reads "Give any MCP-capable AI client governed access to this system — every call runs under the caller's own permissions and row-level security." Inside the running system, user-facing copy names the system the caller is in as "this system".
+- **Unchanged.** The page's name, layout, components and navigation entries, and every MCP route and payload.

.changeset/24405-platform-objects-this-system.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+Clause-②: no (copy only: no accept set or public surface moves; owes the seat's review of record at `TIER_DEFAULT` before the queue)
+
+fix(platform-objects): SSO provider, OAuth application and Connect-an-Agent copy says "this system"
+
+- **What changed.** Inside the running system, user-facing copy names the system the user is in as "this system". The `sys_sso_provider` object description ("External SSO identity providers (OIDC / SAML) this system federates login to"), the `clientId` help text of its Register SSO Provider action ("OAuth client ID issued by the IdP for this system."), and the OAuth applications grid's empty state ("Register an application to let its clients sign users in with this system.") now say so. The `en` copy of the Connect-an-Agent page subtitle follows the page's new text.
+- **Translations.** The zh-CN, ja-JP and es-ES values of the same strings are re-translated, and the recorded source hash of the Connect-an-Agent subtitle moves to the new English text in all three, so those locales keep serving their translation rather than falling back to English.
+- **Unchanged.** Every object, field, action and page name, and all behaviour.

packages/mcp/src/connect-ui.ts

@@ -60,7 +60,7 @@ export const CONNECT_AGENT_PAGE: Page = {
           properties: {
             title: 'Connect an Agent',
             subtitle:
-              'Give any MCP-capable AI client governed access to this environment — ' +
+              'Give any MCP-capable AI client governed access to this system — ' +
               'every call runs under the caller\'s own permissions and row-level security.',
             // `icon` removed here (#6946): `page:header` never drew one — retired from the spec.
           },

packages/platform-objects/src/apps/translations/en.objects.generated.ts

@@ -1491,7 +1491,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
         label: "All",
         emptyState: {
           title: "No OAuth applications yet",
-          message: "Register an application to let its clients sign users in with this environment."
+          message: "Register an application to let its clients sign users in with this system."
         }
       },
       mine: {
@@ -1894,7 +1894,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
   sys_sso_provider: {
     label: "SSO Provider",
     pluralLabel: "SSO Providers",
-    description: "External SSO identity providers (OIDC / SAML) this environment federates login to",
+    description: "External SSO identity providers (OIDC / SAML) this system federates login to",
     fields: {
       id: {
         label: "ID"
@@ -1965,7 +1965,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
           },
           clientId: {
             label: "Client ID",
-            helpText: "OAuth client ID issued by the IdP for this environment."
+            helpText: "OAuth client ID issued by the IdP for this system."
           },
           clientSecret: {
             label: "Client Secret",

packages/platform-objects/src/apps/translations/en.ts

@@ -267,7 +267,7 @@ export const en: TranslationData = {
     connect_agent: {
       label: 'Connect an Agent',
       subtitle:
-        'Give any MCP-capable AI client governed access to this environment — '
+        'Give any MCP-capable AI client governed access to this system — '
         + "every call runs under the caller's own permissions and row-level security.",
     },
 

packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts

@@ -1491,7 +1491,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
         label: "Todas",
         emptyState: {
           title: "Aún no hay aplicaciones OAuth",
-          message: "Registra una aplicación para que sus clientes puedan iniciar la sesión de los usuarios con este entorno."
+          message: "Registra una aplicación para que sus clientes puedan iniciar la sesión de los usuarios con este sistema."
         }
       },
       mine: {
@@ -1894,7 +1894,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
   sys_sso_provider: {
     label: "Proveedor SSO",
     pluralLabel: "Proveedores SSO",
-    description: "Proveedores de identidad SSO externos (OIDC / SAML) a los que este entorno federa el inicio de sesión",
+    description: "Proveedores de identidad SSO externos (OIDC / SAML) a los que este sistema federa el inicio de sesión",
     fields: {
       id: {
         label: "ID"
@@ -1965,7 +1965,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
           },
           clientId: {
             label: "ID de cliente",
-            helpText: "ID de cliente OAuth emitido por el IdP para este entorno."
+            helpText: "ID de cliente OAuth emitido por el IdP para este sistema."
           },
           clientSecret: {
             label: "Secreto de cliente",

packages/platform-objects/src/apps/translations/es-ES.source-hashes.ts

@@ -176,7 +176,7 @@ export const esESSourceHashes: Readonly<Record<string, string>> = {
   'pages.cloud_connection_settings.label': '3a7caad0cb98e71d',
   'pages.cloud_connection_settings.subtitle': 'f5cdd253e8ffef9f',
   'pages.connect_agent.label': 'eeb174613510e87d',
-  'pages.connect_agent.subtitle': '2d0f9a000824e78a',
+  'pages.connect_agent.subtitle': 'b0d7c6d174511bcb',
   'pages.sys_user_detail.label': '6c0d22a931e235bd',
   'pages.sys_organization_detail.label': '3e55836156e1c1de',
 };

packages/platform-objects/src/apps/translations/es-ES.ts

@@ -176,7 +176,7 @@ export const esES: TranslationData = {
     connect_agent: {
       label: 'Conectar un agente',
       subtitle:
-        'Concede a cualquier cliente de IA compatible con MCP acceso controlado a este entorno: '
+        'Concede a cualquier cliente de IA compatible con MCP acceso controlado a este sistema: '
         + 'cada llamada se ejecuta con los permisos propios de quien la realiza y con seguridad a nivel de fila.',
     },
 

packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts

@@ -1491,7 +1491,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
         label: "すべて",
         emptyState: {
           title: "まだ OAuth アプリケーションがありません",
-          message: "アプリケーションを登録すると、そのクライアントがこの環境でユーザーをサインインさせられるようになります。"
+          message: "アプリケーションを登録すると、そのクライアントがこのシステムでユーザーをサインインさせられるようになります。"
         }
       },
       mine: {
@@ -1894,7 +1894,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
   sys_sso_provider: {
     label: "SSO プロバイダー",
     pluralLabel: "SSO プロバイダー",
-    description: "この環境がログインをフェデレーションする外部 SSO ID プロバイダー（OIDC / SAML）",
+    description: "このシステムがログインをフェデレーションする外部 SSO ID プロバイダー（OIDC / SAML）",
     fields: {
       id: {
         label: "ID"
@@ -1965,7 +1965,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
           },
           clientId: {
             label: "クライアント ID",
-            helpText: "この環境向けに IdP が発行した OAuth クライアント ID。"
+            helpText: "このシステム向けに IdP が発行した OAuth クライアント ID。"
           },
           clientSecret: {
             label: "クライアントシークレット",

packages/platform-objects/src/apps/translations/ja-JP.source-hashes.ts

@@ -176,7 +176,7 @@ export const jaJPSourceHashes: Readonly<Record<string, string>> = {
   'pages.cloud_connection_settings.label': '3a7caad0cb98e71d',
   'pages.cloud_connection_settings.subtitle': 'f5cdd253e8ffef9f',
   'pages.connect_agent.label': 'eeb174613510e87d',
-  'pages.connect_agent.subtitle': '2d0f9a000824e78a',
+  'pages.connect_agent.subtitle': 'b0d7c6d174511bcb',
   'pages.sys_user_detail.label': '6c0d22a931e235bd',
   'pages.sys_organization_detail.label': '3e55836156e1c1de',
 };